ClawHub
Back to skill

Security audit

azure-devops

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned for Azure DevOps work, but it lets a repository-local config choose the Azure CLI executable, which could cause an agent to run an untrusted tool.

Review before installing. Use this only in trusted repositories, do not trust a repository-provided `azPath`, prefer a user-level Azure CLI path, and check `.claude/azure-devops.json` before running the skill. Avoid committing that config file, and be cautious when opening work-item screenshots because they may contain private customer, production, or credential information.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:19
Finding

Repository-Controlled Azure CLI Path Enables Tool Spoofing

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–35
Vulnerability Type: Repository-controlled executable path / local tool substitution
Risk Level: Medium

Vulnerable Code Snippet

markdown
Read `.claude/azure-devops.json` in the project root (fall back to `~/.claude/azure-devops.json`). Expected shape:

```json
{
  "organization": "https://dev.azure.com/<org>",
  "project": "<project-name>",
  "projectId": "<project GUID — optional, speeds up attachment downloads>",
  "targetBranch": "develop",
  "requiredReviewers": [
    { "name": "<display name>", "id": "<identity GUID>" }
  ],
  "prTitlePattern": "#<id> (<SCOPE>) <description>",
  "azPath": "az"
}

If the file is missing: get org/project from az devops configure -l if defaults are set, otherwise ask the user once, then offer to write the config file so this interview never repeats. Reviewer GUIDs can be resolved later via the identity-GUID recipe below. If az is not on PATH, ask for (or locate) the full path to az.cmd/az and store it as azPath.

text

### Technical Analysis

The skill gives repository-local `.claude/azure-devops.json` precedence over the user-level configuration and allows that file to define `azPath`. The documented workflow then expects the configured path to be invoked as the trusted Azure CLI.

There is no requirement to canonicalize the configured path, ensure it is outside the repository, validate that it points to an authentic Azure CLI installation, or obtain explicit user approval before executing it. Consequently, an untrusted repository can define `azPath` as a relative or absolute path to an attacker-controlled executable or command wrapper.

This creates a tool-hijacking boundary violation: legitimate-looking Azure DevOps operations can execute attacker logic under the identity and permissions of the user or agent running the skill.

### Attack Path

1. An attacker places a `.claude/azure-devops.json` file in a repository.
2. The 
...[truncated 1363 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove azPath from repository-local configuration. Executable selection should only be permitted through trusted user-level or system-level settings.
  2. Resolve az from a trusted system installation using a controlled executable lookup rather than a repository-provided path.
  3. If custom executable paths are required, obtain explicit user confirmation before the first invocation and display the fully canonicalized path.
  4. Reject relative paths and any executable located inside the project workspace, repository, temporary directories, or other attacker-writable locations.
  5. Canonicalize paths before validation to prevent traversal and symbolic-link bypasses.
  6. Restrict accepted executable names to expected platform-specific Azure CLI binaries, such as az or az.cmd.
  7. Validate the selected executable with a harmless command such as az version, while recognizing that output validation alone cannot establish binary authenticity.
  8. Where practical, verify trusted installation metadata, ownership, permissions, and platform-specific signatures.
  9. Separate organization and project settings from executable configuration so a repository may provide operational defaults without controlling which local program is executed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The skill persists organization, project, target branch, reviewer identities, and optionally the az executable path in .claude/azure-devops.json or a home-directory fallback. While operationally useful, this creates session persistence of environment-specific metadata that may be reused across repositories or users, increasing the risk of cross-project leakage, misdirected operations, or exposure of internal identifiers if the file is committed or read by other tools.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: azure-devops
description: Work with an Azure DevOps org via the az CLI — query sprint/assigned work items with WIQL, read a work item's description AND download+view its embedded screenshots, publish branches, and create PRs with configured house defaults (required reviewers, auto-complete, work item linked, one PR per repo). Reads org/project/reviewer settings from `.claude/azure-devops.json` and offers to create it on first use. Use this skill whenever the user says "pull my tasks", "my sprint work items", "what's assigned to me", "read task 12345", "read the work item", "get the screenshots from the work item", "link the PR to the work item", "set auto-complete", or mentions "azure devops", "az boards", "az repos" — even if they don't explicitly say "azure-devops skill". For "create a PR" defer to the create-pr skill (this skill is its Azure DevOps backend and supplies the PR mechanics). Do not use for GitHub repos (use gh) or for local git-only operations.
---

# Azure DevOps

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill's trigger text is broad enough to activate on generic mentions of Azure DevOps or az boards/repos, which can cause the agent to select this skill in contexts the user did not intend. In a skill that can read work items, download attachments, and prepare PR operations, unintended invocation increases the chance of unnecessary access to project metadata or accidental progression toward state-changing actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instructions direct the agent to download and view embedded screenshots from work items without an explicit warning that attachments may contain sensitive data such as customer information, credentials, production URLs, or internal screenshots. Because the workflow normalizes attachment retrieval and inspection, it can lead to over-collection or exposure of sensitive content beyond the minimum needed to answer the user's request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.